mp_<project-token>_mixpanel Cookie: What the Mixpanel Cookie Stores and Consent Rules

What the mp_<project-token>_mixpanel Cookie Does on Your Site

The mp_<project-token>_mixpanel cookie is a first-party analytics cookie that Mixpanel sets to recognise a visitor and keep the properties sent with every event. The mp_<project-token>_mixpanel cookie stores the ID Mixpanel gives the visitor, the first referrer of the visitor, and the super properties your code registers. Mixpanel attaches the super properties to every event, and "your super properties are stored in the cookie", according to the Mixpanel JavaScript SDK documentation.

The <project-token> part is the project token you pass to mixpanel.init(), so the token 9f8e7d6c5b4a39281706f5e4d3c2b1a0 writes a cookie named mp_9f8e7d6c5b4a39281706f5e4d3c2b1a0_mixpanel. The Mixpanel library builds the name as mp_ plus the token plus _mixpanel. A persistence_name setting renames the cookie to mp_ plus the name you choose, without the _mixpanel ending, according to the Mixpanel SDK source code.

The value of the mp_<project-token>_mixpanel cookie looks like {"distinct_id":"$device:18f2c3a4b5c","$device_id":"18f2c3a4b5c","$initial_referrer":"$direct","$initial_referring_domain":"$direct","__mps":{}}. The table explains each part. Mixpanel publishes no value format, and the keys in the table come from the Mixpanel SDK source code.

Who Sets the mp_<project-token>_mixpanel Cookie

Mixpanel sets the mp_<project-token>_mixpanel cookie through the Mixpanel snippet, which loads mixpanel-2-latest.min.js from cdn.mxpnl.com, or through the mixpanel-browser package that developers bundle into the code of a web app. Look for Mixpanel in the app code as well as in Google Tag Manager, because the package version runs inside your own JavaScript files.

The Mixpanel library writes the cookie with JavaScript on your domain, so the cookie counts as a first-party cookie. Mixpanel receives the visitor ID with every event that the library sends to api-js.mixpanel.com.

Read how Mixpanel, Inc. handles the data in the Mixpanel privacy policy, and sign the Mixpanel data processing terms before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.

Does the mp_<project-token>_mixpanel Cookie Need Consent?

Yes, the mp_<project-token>_mixpanel cookie needs consent in the EU and the UK, and needs no prior opt-in in California. The table gives the rule for each law.

The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Mixpanel, such as Session Replay.

The ePrivacy Directive requires consent before a site sets the mp_<project-token>_mixpanel cookie. The General Data Protection Regulation (GDPR) sets the standard for that consent: freely given, specific, informed, and unambiguous.

The UK Privacy and Electronic Communications Regulations (PECR) exempt analytics cookies that produce aggregate statistics to improve the site. The exemption comes from the Data (Use and Access) Act 2025 and took effect on 5 February 2026. The exemption needs clear information for visitors and a simple and free way to object, according to the ICO guidance on the exceptions. The exemption allows no tracking or profiling of individual visitors. The vendor needs to act as your processor, and recordings of individual visitors and advertising purposes stay outside the exemption. Mixpanel tracks each visitor under a distinct ID, and Session Replay records how each visitor moves through the page. The ICO excludes the tracking of individual visitors and recordings of individual visitors from the statistics exemption, so the exemption does not cover the mp_<project-token>_mixpanel cookie.

The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the mp_<project-token>_mixpanel cookie. Visitors get no right to opt out of the mp_<project-token>_mixpanel cookie while Mixpanel acts as your service provider. The service provider role needs a contract that limits the use of the data to the service for your site.

Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.

How to Block the mp_<project-token>_mixpanel Cookie Until Visitors Accept

Block the mp_<project-token>_mixpanel cookie by holding back the Mixpanel snippet until the visitor accepts analytics cookies. TermsFeed Free Cookie Consent and TermsFeed Privacy Consent place Mixpanel in the analytics category. Check whether an exemption applies to your own use of Mixpanel in the consent rules for the mp_<project-token>_mixpanel cookie.

Mixpanel writes no mp_<project-token>_mixpanel cookie while the Mixpanel snippet waits as a tagged script, so a visitor who declines sends no event to Mixpanel.

<script type="text/plain" data-cookie-consent="tracking">
(function(e,c){if(!c.__SV){var l,h;window.mixpanel=c;c._i=[];c.init=function(q,r,f){function t(d,a){var g=a.split(".");2==g.length&&(d=d[g[0]],a=g[1]);d[a]=function(){d.push([a].concat(Array.prototype.slice.call(arguments,0)))}}var b=c;"undefined"!==typeof f?b=c[f]=[]:f="mixpanel";b.people=b.people||[];b.toString=function(d){var a="mixpanel";"mixpanel"!==f&&(a+="."+f);d||(a+=" (stub)");return a};b.people.toString=function(){return b.toString(1)+".people (stub)"};l="disable time_event track track_pageview track_links track_forms track_with_groups add_group set_group remove_group register register_once alias unregister identify name_tag set_config reset opt_in_tracking opt_out_tracking has_opted_in_tracking has_opted_out_tracking clear_opt_in_out_tracking start_batch_senders start_session_recording stop_session_recording people.set people.set_once people.unset people.increment people.append people.union people.track_charge people.clear_charges people.delete_user people.remove".split(" ");
for(h=0;h<l.length;h++)t(b,l[h]);var n="set set_once union unset remove delete".split(" ");b.get_group=function(){function d(p){a[p]=function(){b.push([g,[p].concat(Array.prototype.slice.call(arguments,0))])}}for(var a={},g=["get_group"].concat(Array.prototype.slice.call(arguments,0)),m=0;m<n.length;m++)d(n[m]);return a};c._i.push([q,r,f])};c.__SV=1.2;var k=e.createElement("script");k.type="text/javascript";k.async=!0;k.src="undefined"!==typeof MIXPANEL_CUSTOM_LIB_URL?MIXPANEL_CUSTOM_LIB_URL:"file:"===
e.location.protocol&&"//cdn.mxpnl.com/libs/mixpanel-2-latest.min.js".match(/^\/\//)?"https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js":"//cdn.mxpnl.com/libs/mixpanel-2-latest.min.js";e=e.getElementsByTagName("script")[0];e.parentNode.insertBefore(k,e)}})(document,window.mixpanel||[])
mixpanel.init('YOUR_PROJECT_TOKEN', {track_pageview: true});
</script>

Block the mp_<project-token>_mixpanel Cookie With the Mixpanel Opt-Out Settings

Hold back the whole Mixpanel snippet until the visitor accepts analytics cookies, as the Cookie Consent box shows. The Mixpanel opt-out settings alone still let Mixpanel write the mp_<project-token>_mixpanel cookie. The setting opt_out_tracking_by_default: true stops tracking, and the SDK clears its stored data only when opt_out_persistence_by_default is true as well, according to the Mixpanel SDK source code.

Call mixpanel.opt_out_tracking() when a visitor withdraws consent on a page where Mixpanel already runs. Test any setup that relies on the opt-out settings instead of a held-back snippet in a private window. Check the first page view, the opt-in, a withdrawal, and a later visit.

How to Verify That the mp_<project-token>_mixpanel Cookie Waits for Consent

Verify the setup in a private window. Open Chrome DevTools, select the Application tab, and open Cookies. Click "I decline" on the consent banner and reload the page. The mp_<project-token>_mixpanel cookie must not appear in the list until you accept analytics cookies.

How Long the mp_<project-token>_mixpanel Cookie Lasts

The mp_<project-token>_mixpanel cookie lasts 1 year (365 days). Safari caps the cookies that JavaScript sets at 7 days of Safari use without an interaction with your site, according to the WebKit team behind Safari.

Change the lifetime with the cookie_expiration setting of mixpanel.init(), which takes a number of days. Mixpanel keeps super properties "for the life of that cookie, which by default is 365 days", according to the Mixpanel JavaScript SDK documentation.

Set persistence to localStorage to keep the same data in local storage instead of a cookie. The local storage key carries the same name, so the ePrivacy Directive still requires consent, and cross-subdomain tracking stops working, according to Mixpanel.

Cookies That Work Together With mp_<project-token>_mixpanel

Mixpanel sets 1 browser storage key next to the mp_<project-token>_mixpanel cookie in its current setup, and 2 resources replace a listed one in another setup. Rows marked "alternative" replace a listed resource when your site changes a setting of Mixpanel.

Scripts and Requests of Mixpanel That Come With the mp_<project-token>_mixpanel Cookie

The catalog lists 2 scripts, pixels, and data endpoints of Mixpanel, which a cookie scanner or the Network tab of Chrome DevTools shows next to the mp_<project-token>_mixpanel cookie. Block the main script, and the requests in the table stop with the main script.

mp_<project-token>_mixpanel Cookie FAQs

Is the Mixpanel mp_ cookie a necessary cookie?

No, the mp_<project-token>_mixpanel cookie is not a strictly necessary cookie. Firstly, your site works the same for a visitor who refuses the Mixpanel cookie. Secondly, Mixpanel uses the cookie to measure visitors, a purpose the ePrivacy Directive exemption does not cover. Thirdly, Mixpanel itself offers opt-out settings for visitors who refuse tracking.

Why does the Mixpanel cookie name contain my project token?

The Mixpanel cookie name contains your project token because the Mixpanel library builds the name as mp_ plus the project token plus _mixpanel. A site that sends data to 2 Mixpanel projects sets 2 cookies. The project token appears in the page source anyway, so the cookie name reveals nothing new.

Does Mixpanel work without cookies?

Yes, Mixpanel works without cookies when you set persistence to localStorage, and Mixpanel still needs consent in the EU. Firstly, the library keeps the same data under the same name in local storage. Secondly, Article 5(3) of the ePrivacy Directive covers any information stored on the device of the visitor, according to the EDPB Guidelines 2/2023 on the technical scope of Article 5(3). Thirdly, cross-subdomain tracking stops working with local storage, according to Mixpanel.

What is the __mp_opt_in_out key?

The __mp_opt_in_out_<project-token> key stores the opt-in or opt-out choice that your code passes to Mixpanel with opt_in_tracking() or opt_out_tracking(). Mixpanel keeps the key in local storage by default and in a cookie when opt_out_tracking_persistence_type is cookie, according to the Mixpanel SDK source code. The Mixpanel library reads the choice on every page load and tracks nothing while the choice is an opt-out.